This project is an early-stage reference implementation. Only the latest version on the main branch is actively maintained.

Please do not open a public GitHub issue for a security vulnerability.

Use GitHub's private vulnerability reporting or Security Advisories for this repository when available. If that option is unavailable, contact @mangeshraut712 privately through GitHub.

Include enough information to reproduce the issue, including:

• A description of the impact
• The affected component or endpoint
• Reproduction steps or a proof of concept
• Any suggested mitigation

Please allow reasonable time for investigation and remediation before making the issue public.

Dependabot version updates and Dependabot security updates are disabled for this repository. Automated updater jobs were failing (for example when a security fix required a major bump that could not be applied automatically). Dependency changes are reviewed and applied manually, using the same install, audit, and CI checks as other code changes.

• Never commit .env files or credentials.
• Use development-only API keys locally.
• Use a strong, separate AUTH_SECRET and API_KEY_HASH_PEPPER in production.
• Do not use development login settings in production.